How to Use Internal Controls to Mitigate Risk & Protect Profits

Today I’m going to talk about internal controls.

Whoa, what a bore, right? This topic shouldn’t appear on BiggerPockets, a real estate investor’s hub.

Well, as real estate investors, we may undertake business ventures related to real estate, and those business ventures ought to have sufficient internal controls — so there. I also read a recent Forum post about a missing $1,000, which spurred the accountant in me and further encouraged the writing of this article. Grab a cup of coffee, take an espresso shot or two, and let’s do this.

It didn’t really occur to me that business people don’t know much about internal controls (I’m an accountant, after all). And who can really blame them? Internal controls can be a dry subject, and they are purely a cost center from a business perspective. However, neglecting development of controls will subject your business to huge risks that are harder to mitigate as time goes on, and entrepreneurs habitually tend not to place an early emphasis on developing internal controls (kudos to the author of that Forum post for implementing controls).

Internal controls mitigate risks, decrease fraud, establish standard operating procedures, and organize information. You’d probably agree that your business needs to operate seamlessly internally to continuously offer the highest quality of service to your clients. So it’s important to have at least a basic understanding of controls.

While I’m not going to delve into detail on the five components of internal controls, I will mention them so that you can research them on your own. The five components of internal controls are:

Control Environment: Attitude of the company, management, and staff towards implementing and following internal controls.
Risk Assessment: Has management identified the riskiest areas to implement internal controls?
Control Activities: policies and procedures.
Information & Communication: Information systems being used, safeguarding of assets, communication systems and processes.
Monitoring: What procedures are in place to monitor control effectiveness over time?

The idea is that if your business has a handle on these areas, then you are likely doing a decent job in mitigating risks.

Are you groaning yet? Come on! This is the stuff that gets us accountants excited! Internal controls are like an ever-evolving puzzle that needs to be solved. It’s preventing the crime before it happens, like a true detective (in my own mind).

Okay, maybe you aren’t excited, but I think everyone needs to know about segregation of duties, as that is truly applicable to all businesses that have employees. Let’s demonstrate with an example.

Segregation of Duties: An Example

The author of the $1,000 missing Forum post runs a property management company that really only accepts rents in cash form, not because they haven’t implemented online cash acceptance systems, but because the demographics of their tenants restrict such an implementation. In any business, segregation of duties is important; however, in a cash-based business, the importance of segregating duties exponentially increases.

There are three primary duties that should not be performed by the same employee: custody of assets, authorization of transactions, and recording those transactions.

In the Forum post, the author says that his front desk guy accepts rent from tenants in the form of money or money orders (custody of assets), seals the money in an envelope, writes the amount on the front of the envelope, and then slips the envelope into a locked cabinet with a mail slot. That’s an example of a solid control. The employee has custody of the assets, but is not authorizing or recording transactions.

Two people have keys to the locked cabinet, which are the bookkeeper and the owner. The bookkeeper comes into the office, unlocks the cabinet, and removes the envelopes (custody of assets). He then opens the envelops and counts the money. If the money agrees with the written amount on the envelope, the bookkeeper records the transaction on the books and shreds the envelope. Uh oh… now we have a bookkeeper who has custody of assets and record-keeping abilities. This is a prime example of a lack of segregation of duties and a weak control.

What if the bookkeeper took the $1,000 and simply decides not to record that amount in the books? Nobody will know this has occurred until the tenant refutes the notice of delinquency issued to them for underpayment of rent by $1,000. By then, the bookkeeper could be long gone or figured out a way to cover up his/her omission.

The $1,000 in the example was actually a money order, so there is an added layer of protection here. However, it’s important to note that someone who takes custody of assets and has the responsibility of recording the amount on the books allows that person to manipulate the numbers in many different ways.

Ways to Mitigate Risks Related to Cash Receipts

The easiest way to mitigate the risk from the bookkeeper described above will be for the front desk guy to maintain a log of all money received, in manual or electronic format, as well as to record the amount received, the name of the payer, purpose of the payment and its form (cash or check). After the bookkeeper has entered all transactions into the system of record, this log can be reconciled to the system of record and the bank. If there is a discrepancy, it will be easy to determine who is at fault, whether or not the act was intentional.

Another great internal control, which the author of the Forum post does use, is to simply provide a receipt. Receipts should be pre-numbered and two-part, meaning one copy should be provided to the payer, while the other copy is kept on file. Total deposits should then be verified independently by another person who will account for each sequentially numbered receipt.

It wasn’t clear in the Forum post whether or not the bookkeeper also deposits the cash; however, a general rule is to keep cash, checks, and money orders in a locked and secure cabinet until they can be deposited. Access to the cabinet should be restricted to only two people, one of whom is simply a backup. When the deposit is made at the bank, the deposit slip should reconcile to the total amount recorded on the log. This reconciliation will be the bookkeeper’s duty, and he/she will then record amounts in the books.

Additional Controls to Mitigate Risks

Many landlords receive rent via mail. If you have employees, make sure two people are present when the mail is opened. One person should total the remittances and the other, the payments. The totals should then be agreed upon and the remittances forwarded to the appropriate area for data entry. A deposit slip should be prepared and reconciled by a third person.

Strive to make timely deposits, ideally within 24 hours. The sooner you made a deposit, the less exposure to theft or loss of funds.

As I mentioned, make sure that duties are appropriately segregated. This means that the person recording the receipt should not be the same as that making the deposit, and a person independent of the recorder and fund depositor should reconcile the deposit to the general ledger. If there are only two people to perform these duties, the reconciliation should be performed by the person collecting the receipts, not by the person who has access to the cash.

Keep transfers of cash from person to person to a minimum. Accountability is lost when several people handle cash before it’s deposited. Use of a drop-off/pick-up log can be beneficial when transporting deposits.

Summary

Hopefully this article will help out new and smaller businesses in mitigating control risks. If you are starting to take on employees, you may want to consider asking your accountant about proper structuring and implementation of internal controls in order to proactively establish procedures that ensure your business will run smoothly.

Disclaimer: This article does not constitute legal advice. As always, consult your CPA or accountant before implementing any tax strategies to ensure that these methods fit with your particular situation.

Investors: What internal controls have YOU implemented in your business to mitigate risk?

Let me know your suggestions, tips and questions with a comment!

Note By BiggerPockets: These are opinions written by the author and do not necessarily represent the opinions of BiggerPockets.